ISC Stormcast For Tuesday, August 25th, 2026 https://isc.sans.edu/podcastdetail/10066, (Tue, Aug 25th)
2026-08-25T13:23:40Z•1ac75352e52f168595f54419f2d70e93c1c7e50cd1990dd8273cd208f035b244
DOUBLECUPIAM credentialsMFA auditingMicrosoft Entra IDMicrosoft GraphPNG payloadPowerShellSANS ISCcloud metadata servicecloud reconnaissancecloud securitycredential theftmalwarepassword sprayingrisky sign-inssteganography
What happened
SANS Internet Storm Center digest covering August 19–25, 2026 security topics, including DOUBLECUP PNG payload delivery using obfuscation or steganography-like techniques, Microsoft Entra and Graph API reconnaissance, MFA coverage auditing, password-spray and risky-login detection, and cloud metadata service scanning for exposed IAM credentials. The collection is primarily advisory and defensive, with cloud credential exposure and account compromise risks highlighted.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 1ac75352e52f168595f54419f2d70e93c1c7e50cd1990dd8273cd208f035b244
- Enrichment time
- 2026-08-25T13:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.